Virtually every organisation is already using at least one cloud-based service, and most are using several. Sometimes the services are chosen without the consent of the CIO. To get back on top of things the CIO should make sure she or he is actively involved in at least setting the guidelines for how to choose the right cloud-based systems. I spoke with four IT leaders and one analyst to explore the different criteria CIOs might use when choosing cloud-based services. [See also: Choosing cloud services - SaaS advice from CIO David Jack]

In cases where consumer IT gets ahead of enterprise IT, workers tend to bring to work the applications and services they use at home. Two examples of Cloud services that frequently show up in the enterprise in shadow-IT mode are Dropbox and Google Drive.

IS Director at United Utilities William Hewish says he isn't too concerned by shadow IT. He sees it as a signal from users that either they don't understand what the IT department has to offer to meet their needs, or that they have unmet needs. In the first case, CIOs should make sure they're communicating what services they offer to the workforce. In the latter case, CIOs should take a closer look at users' needs and look for ways of better meeting those requirements.

One solution that is increasingly common is to look for enterprise versions of consumer applications and services, backed by service level agreements and robust approaches to privacy and data protection. For example, Dropbox has an enterprise edition and both Google and Microsoft have created online enterprise collaboration suites that bring together enhanced version of consumer-oriented products.

Martin Hamilton, Futurist at Jisc, said: "CIOs should look at these enterprise wraps around consumer products, and ask a number of questions about which ones are appropriate. Which offering has traction in my company? Which one of these can I realistically get my users to move over to the enterprise version? Is it easy to switch to? Can workers use it easily?"

Hamilton, who negotiates Cloud services on behalf of educational institutions across the UK, says, "Enterprise wrap around consumer Cloud-based apps can be done in an attractive way for the individual employees."

When choosing a cloud service IT directors should look for these five things:

Choosing cloud services - Technology

1. First and foremost, the Cloud service has to match your technology set. The service has to integrate with your existing back end, and the method of integration and APIs have to fit your way of operating - and they especially have to fit your security model.

Martin Hamilton said: "A huge issue for CIOs is managing a mixed economy of organisational and cloud identities, and dealing with leavers who may have shared files and other resources. This is particularly pressing for education and research institutions, with new cohorts every year, and the need to work fluidly across organisational boundaries. Federating your organisation's directory with products like Microsoft's Azure Active Directory is a huge step forward, making it trivial to use existing organisational identities with cloud services. Most importantly, you can do this without having to open a hole in your firewall."

Choosing cloud services - Lock-in

2. Make sure the degree to which you'll be locked into the service is acceptable. Simon McCalla, CTO at Nominet UK, said: "Our policy when we pick providers is, where pragmatic, to try to get relatively short contract duration, and to be able to move from one provider to another. I think it's healthy in terms of negotiating good deals, because some suppliers will try to use lock-in to strengthen their position when renegotiating the contract."

But according to Forrester Senior Analyst Paul Miller: "Avoiding lock-in might be a useful opening premise, but there's a need for pragmatism. Building everything in a way that's free from lock-in is certainly possible, but it's likely to take longer and - perhaps - cost more. Don't avoid lock-in in every situation. But ensure that it's a conscious decision rather than an accident you might later regret."

Choosing cloud services - Scale

3. Make sure the convenience and scale of the offering - and the maturity of the provider - meet your requirements. Group CTO at Lebara Finbarr Joy sadi: "The service has to be easy to use and their support model has to meet your needs. You should look for a service that scales both up and down, as your capacity needs change. Finally, you should go with a provider that is a mature company with solid market penetration, especially in your industry."

Choosing cloud services - Security

4. The Cloud service has to provide the level of security you need. Forrester's Paul Miller says: "CIOs increasingly recognise that big public cloud providers may be as good - or better - than whatever they can do on-premises. Those cloud providers are also getting a lot better at demonstrating compliance with regional, national and international regulations around data security, privacy, territoriality and more; and all of them have pages on their sites that list the relevant accreditations."

William Hewish cautioned: "Even though large Cloud providers almost certainly provide better security than you can, don't assume you get the appropriate level of security out of the box. You probably have to select the proper service either in tick boxes or when you negotiate a Cloud contract."

Choosing cloud services - Roadmap

5. The Cloud provider should have the vision and roadmap that will bring you forward. Finbarr Joy said: "Given that you may lock yourself into a relationship with a Cloud provider, you have to decide who you want to tie your wagon to. It's best to do that with a provider who is an industry leader, one who is leading change. It's still early days and there are still a lot of new things to come. You want to be with the provider who gets you to the future first."

Simon McCalla said: "We are a technology business and we want to get the strong benefits from our technology - not just currently, but as things change. Occasionally, the supplier will surprise you with new technology that you can use. In the best case, it winds up being a symbiotic relationship where you help them with their roadmap and vice-versa."